Re: BIND exploited ? -UPDATE #2

2002-01-06 Thread Thedore Knab

How does this sound ?

The system has been rebuilt.

It is running Bind 9.2 chroot version on RH 7.2. Someone else built it. I prefer
Debian or OpenBSD. I will add tripwire and chkroot kit to run as a cron
job.

The harddrives will be saved for further investigation at a later date.

Since the harddrives have been modified in a hack effort to patch the
problem, I don't think it can be used as evidence.

Snort will also be installed on an OPENBSD box at the edge of the nework to monitor the
administrave network, and on the administrative network.

-Ted


-- 
To UNSUBSCRIBE, email to [EMAIL PROTECTED]
with a subject of unsubscribe. Trouble? Contact [EMAIL PROTECTED]




Re: BIND exploited ? -UPDATE #2

2002-01-06 Thread Thedore Knab
How does this sound ?

The system has been rebuilt.

It is running Bind 9.2 chroot version on RH 7.2. Someone else built it. I prefer
Debian or OpenBSD. I will add tripwire and chkroot kit to run as a cron
job.

The harddrives will be saved for further investigation at a later date.

Since the harddrives have been modified in a hack effort to patch the
problem, I don't think it can be used as evidence.

Snort will also be installed on an OPENBSD box at the edge of the nework to 
monitor the
administrave network, and on the administrative network.

-Ted